Privacy Policy

Last Updated: June 20, 2026

Introduction

Welcome to Face Minds, a product of BynarTek ("we", "us", "our"). BynarTek is the data controller for personal data collected through Face Minds. We respect your privacy and are committed to protecting your personal data.

1. Information We Collect

1.1 Personal Information

Account Information: Email address, phone number, display name, and profile photo
Profile Information: Profile photos and biographical information you add
Family Tree Data: Names, dates, relationships, biographical details, and custom fields for family members
Face Memory Data: Name, date of birth, contact details, address, notes, events, stories, prompt responses, and photos for Face Memory profiles
Photos and Videos: Images and videos you upload for family members, Face Memory profiles, events, and face recognition
Private Notes: Personal notes you write about Face Memory profiles (visible only to you)
Social Data: Friend connections, friend requests, and social interactions within the app
Chat and Messaging Data: Messages, group conversations, group names, group membership, and message read receipts
Event and Discussion Data: Content you post in category events, discussions, and comments

1.2 Automatically Collected Information

Device Information: Device type, operating system, and app version
Usage Data: App features you use and how you interact with the app
Performance Data: App crashes and performance metrics
Subscription Information: Your subscription tier, purchase history, and billing status (processed through RevenueCat)
Session Information: Login sessions, session tokens, and device push notification tokens
Advertising Data (Free tier only): Device advertising identifiers, ad views, and interactions (collected by AdMob)

1.3 Face and Biometric Data

Apple App Store Disclosure: This app collects face data to enable face recognition features. Face data is used solely to identify individuals in your uploaded photos and is never used for advertising or shared with third parties for their own purposes.

What we collect:

Facial images (JPEG photos) you upload for face recognition
Face embedding vectors — mathematical numerical representations (~512 floating-point numbers) computed from your photos. These encode facial geometry but cannot reconstruct the original image.

How it is processed — step by step:

You upload a face photo within the app.
The photo is transmitted over an encrypted HTTPS connection to our server.
Our server sends the photo to Amazon Web Services (AWS) Lambda (ap-southeast-2 region) solely to compute the face embedding vector. AWS processes the image transiently — it does not retain the image or embedding after returning the result.
The resulting numeric embedding vector is stored in ChromaDB, a vector database running on our own self-hosted infrastructure.
The original face crop image (JPEG) is stored in S3-compatible storage, our self-hosted object storage server.

No face data is sold or shared with any third party for their own purposes. AWS acts solely as a data processor under our control for the duration of the computation. Explicit consent is required before any face data is collected or processed. You may withdraw consent and delete all face data at any time from within the app.

2. How We Use Your Information

Service Provision: Creating and managing family trees, Face Memory profiles, and group chats
Face Recognition: Identifying faces in photos to help organize and retrieve memories
Account Management: Authenticating and managing your account and session security
Real-Time Messaging: Delivering chat messages and notifications to conversation participants
Push Notifications: Sending notifications about new messages, events, and app activity
Social Features: Managing friend connections and collaborative access to shared content
AI-Powered Prompts: Generating personalized daily prompts to help you capture memories (uses Claude AI by Anthropic — see Section 8)
Family Tree Photo Import: Parsing uploaded photos of printed family trees to extract member data (uses Claude AI by Anthropic — see Section 8)
App Improvement: Analyzing usage to improve features and performance
Support: Providing customer support when requested

3. Data Storage and Security

All data is stored on our own self-hosted servers
All PII fields (names, email, phone number, address, notes) are encrypted at rest using AES-256-GCM
Photos and videos are stored in self-hosted S3-compatible object storage
Face embeddings are stored in self-hosted ChromaDB vector database
Messages and conversations are stored in MongoDB with encrypted PII fields
All data in transit is encrypted via HTTPS/TLS
Authentication via Firebase with single-session enforcement — session tokens are invalidated on every new login
Access to face data requires explicit biometric consent before any processing

4. User Responsibility for Shared Content

4.1 Scope

This applies to ALL personal data you upload to Face Minds: family tree members, Face Memory profiles (friends, colleagues, community members), any person in photos or events you create, and historical or deceased individuals.

4.2 Your Responsibility

You are solely responsible for all personal information, photos, and data you upload or share
You must have proper consent from any individuals whose personal information or photos you add
You must have legal authority to share information about any individuals
You assume all liability for any privacy violations or legal issues arising from content you upload
You will not use the App to track or collect information about individuals without their knowledge and consent

4.3 Third-Party Privacy Rights

You have obtained explicit consent before uploading others' photos or personal information
You will not upload photos of individuals who have refused or withdrawn consent
You will immediately remove any content upon request from the individual depicted

4.4 Indemnification

You agree to indemnify, defend, and hold harmless Face Minds and BynarTek from any claims, damages, losses, or legal fees arising from your violation of any person's privacy rights or uploading content without proper authorization.

5. Data Sharing

We do NOT sell your personal data.

With Your Consent: When you explicitly share family trees or Face Memory categories with other users
Service Providers (Data Processors): Third-party services listed in Section 8
Legal Requirements: When required by law, court order, or to protect rights and safety

What is NOT shared: Face embeddings are never shared with third parties. Chat messages are delivered only to conversation participants. Your personal data is never used for advertising by us.

5.1 Advertising Partners (Free Tier Only)

Free tier users see advertisements served by Google AdMob. AdMob may collect device advertising identifiers (IDFA/AAID), IP address, and ad interaction data. Memories and Archive subscribers do not see ads and their data is not shared with advertising partners.

6. Your Rights and Choices

Access: Request a copy of your personal data
Correction: Update or correct inaccurate information
Deletion: Delete your account and all associated data (processed within 30 days)
Face Data Deletion: Delete all face embeddings and images at any time via app settings
Withdraw Biometric Consent: Revoke face recognition consent at any time
Data Export: Download your family tree data in a portable format
Opt-out of Face Recognition: Disable face recognition without deleting your account
Ad Preferences: Opt-out of personalized advertising through device settings
Subscription Management: Manage or cancel subscriptions through App Store or Google Play

7. Children's Privacy

Our app is designed for users 13 and older. We do not knowingly collect personal information from children under 13 without parental consent. Contact us at faceminds@bynartek.com if you believe your child has provided us personal information.

8. Third-Party Services

Service	Purpose	Data Shared
Firebase Authentication (Google)	Account authentication	Email, UID
RevenueCat	Subscription management	Purchase history, subscription status
Google AdMob	Advertisements (free tier only)	Device identifiers, ad data
Amazon Web Services (AWS) Lambda	Face embedding computation	Face photo (transient — not retained by AWS)
Anthropic (Claude AI)	AI prompts & family tree photo import	Prompt text, uploaded tree photos
Firebase Cloud Messaging (Google)	Push notifications	Device push token

8.1 Anthropic (Claude AI) — Important Disclosure

The app uses Claude AI by Anthropic for two features: (1) Daily Prompts — prompt templates are sent to Anthropic's API; your personal Face Memory data is not sent. (2) Family Tree Photo Import — when you upload a photo of a printed family tree, the image is sent to Anthropic's API to extract member data; the image is processed transiently and not retained by Anthropic. You are informed before these features send data to Anthropic.

9. International Data Transfers

Your data may be processed outside your country of residence, including AWS servers in ap-southeast-2 (Sydney, Australia) for face embedding computation, and Anthropic servers in the United States for AI-powered features. We ensure appropriate safeguards are in place for all international transfers.

10. Data Retention

Data Type	Retention Period
Account and profile data	Until account deletion
Family tree and Face Memory data	Until deleted by user or account deletion
Face embeddings and images	Until deleted by user or account deletion
Chat messages	Until deleted by user or account deletion
Biometric consent records	Until account deletion (compliance audit)
Deleted account data	Purged within 30 days
Legal/compliance hold data	Up to 90 days after account deletion

11. Changes to This Privacy Policy

We may update this privacy policy from time to time. We will notify you of significant changes through in-app notifications, email, or an updated "Last Updated" date.

12. Contact Us

If you have questions about this privacy policy, contact BynarTek:
Email: faceminds@bynartek.com

13. Your Consent

By using our app, you consent to this privacy policy. By uploading photos or personal information of other individuals to Face Minds, you confirm that you have obtained their explicit consent and accept full responsibility for any legal consequences.

GDPR Compliance (EU Users)

Right to data portability
Right to object to processing
Right to restrict processing
Right to lodge a complaint with your national supervisory authority
Lawful basis for processing face data: Explicit Consent (Art. 9(2)(a) GDPR)

CCPA Compliance (California Users)

Right to know what personal information is collected and how it is used
Right to know if personal information is sold or disclosed (we do not sell it)
Right to opt-out of any sale of personal information
Right to non-discrimination for exercising CCPA rights

Vietnam PDPL Compliance (Vietnamese Users)

Additional rights under Nghị định 13/2023/NĐ-CP, effective January 1, 2026:

Biometric and Face Data Processing

Explicit Consent Required: We obtain your explicit, voluntary, specific, and fully informed consent before processing any biometric data. This consent is separate from general app consent and can be withdrawn at any time.
Purpose Limitation: Your biometric data is processed solely for face recognition within Face Minds — never for advertising or profiling.
Right to Withdraw: Withdraw consent at any time via App Settings → Privacy → Biometric Consent.
Audit Trail: Every biometric processing operation is logged with timestamp, IP address, and device info.

Your Rights Under PDPL

Right to Know, Access, Correction, Deletion, Restrict Processing, Data Portability, Objection

Data Security & Breach Notification

All PII encrypted with AES-256-GCM at rest
In case of a data breach, we will notify affected users within 72 hours and report to the Ministry of Public Security (Bộ Công an) as required by law

Contact for PDPL Data Protection: faceminds@bynartek.com